PDF malware analysis — malicious · addb8ed93e676d2c

MALICIOUS

PDF

89.6 KB Created: 2021-05-26 16:21:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22

MD5: 452369877056c0cb23d784184bf8119b SHA-1: 7d44e44f7f89bac33d2a144721cfada36f1675ba SHA-256: addb8ed93e676d2cfbd7323b9e95fd402e67f4a5ba477fcb119821c43306f7db

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, with one pointing to 'ponafet.ru', which is flagged as suspicious. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm designed to lure users. ClamAV detection and ML classification further support its malicious nature, likely as a phishing or malware distribution vector.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ponafet.ru/strik?utm_term=lee+raon+my+hero+academia+op+2+-+peace+sign PDF link annotation
- https://rujijixagav.weebly.com/uploads/1/3/1/3/131383475/jodijirodi-midolimowomasug-jabum-tejemigopugu.pdfIn PDF document text
- https://wamabiror.weebly.com/uploads/1/3/1/1/131163705/8bd03bf17f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/c4a282af-ef85-4eac-9d3c-c97e5796d718/19934580003.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ef970042-03ed-421b-ae83-f2b20bc9f656/formato_de_entrevista_semiestructurada_laboral.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8dafc041-feb2-4092-8a9f-94ec5936b3ed/58339488367.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6e4dad08-fb18-433e-8532-5751d86424ed/adobe_photoshop_tpb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/910b911b-fe96-4b7c-a2a6-09e720062273/can_you_cook_a_turkey_crown_in_a_slow_cooker_uk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b7946f21-eefd-4894-ae24-0e12297256de/how_do_you_take_apart_a_kenmore_800_series_dryer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e189504c-3d9e-4b49-bfac-2fb109a80037/how_to_read_payne_model_number.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/961b6392-c93d-4b23-b009-d8130d7e16b9/beautiful_creatures_caster_quiz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/677e20d9-4d2b-4e3c-8203-9c38ecdda10e/53207621729.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/53e54b95-439d-49df-8926-b379c6df9c60/laruwifo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01076a0d-9d5d-4550-b6b7-4a40741d11ba/pufujekizewizinowul.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ac5502a5-38ec-4374-a6d6-0fb0033c28cb/95910692569.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/164b327d-4d41-41d2-a78c-4a3f57f40623/pagek.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/58e6e1b5-e344-4d74-9e82-6038c47340f2/how_to_apply_vinyl_to_kitchen_cupboards.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc85c23d-5e97-411a-af69-ce9f845813b3/kindle_d01200_not_charging.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5091d6c6-bdea-4ff8-974a-194e941444ab/xobuxowamezojepolabozose.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d606.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD606	16144 bytes
SHA-256: `c06d5378cb4d61c8508ca9241c5087166d6d887df17353f9c1df988fab36f72b`
`font_01_sfnt_off000107e4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x107E4	5664 bytes
SHA-256: `794c003351baef29df335e19c5b96dba65b72d81560c64b9a99b1e736e022000`
`font_02_sfnt_off00011b0b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11B0B	10076 bytes
SHA-256: `a9fd71bd7adec8441d980d10373a15733258f8bcbf45781af0384ff09b6804c5`
`font_03_sfnt_off00013df0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13DF0	17148 bytes
SHA-256: `5b396ae4c92e5a22b116122c412778488cd171ece3ababcdaff17e67a7bc430c`

Open this report in the interactive analyzer, or submit your own file for analysis.